dreampiler/kandev
1
0
Fork 0
Code Issues 43 Pull Requests Actions 6 Packages Projects Releases Wiki Activity

feat(github): add task git credential policy (#1985)

Browse Source
This commit is contained in:
Carlos Florêncio
2026-07-27 18:10:12 +01:00
committed by GitHub
parent 85820e4a43
commit b39a668e99
62 changed files with 2687 additions and 208 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/public/executors.md
+8
View File
@@ -68,6 +68,14 @@ Two current preparation exceptions are easy to miss:
## Managed GitHub credentials
The workspace's GitHub connection and the task's Git transport policy are separate. **Managed
workspace credentials** is the default and provides the broker behavior below. Select **Inherit
executor Git credentials** in the workspace GitHub settings to leave Git and `gh` to the host or
selected executor; Kandev then injects no GitHub broker helper or shim. Local and Worktree use
host-visible Git/SSH credentials, while Docker, SSH, and cloud require executor-configured
credentials. An explicit executor-profile `GH_TOKEN` or `GITHUB_TOKEN` overrides the managed
workspace route.
For attached GitHub repositories, Kandev normally gives the task an opaque lease for each
repository instead of placing the workspace PAT, selected CLI token, or App installation token in
its ambient environment. Git's credential helper selects the lease whose HTTPS host and path